#include "pch.h"

#include "check_memory.h"

#include "skCrypter.h"

#include "indirect_calls.h"

#include "GetProcAddressSilent.h"

#include <intrin.h>

#pragma region Anti Step-over (then directly overwrite it with NOP)

bool check_memory_antistepover_direct()

}

#pragma endregion

#pragma region Anti Step-over (then overwrite with the original Op with ReadFile())

bool check_memory_antistepover_readfile()

}

#pragma endregion

#pragma region Anti Step-over (then overwrite with NOP using WriteProcessMemory())

const BYTE mem_antistepover_writeprocessmrmory_buffer[] = { 0x90 }; // NOP

bool check_memory_antistepover_writeprocessmemory()

}

#pragma endregion

#pragma region NtQueryVirtualMemory

bool check_memory_ntqueryvirtualmemory()

{

#ifndef _WIN64

auto pfnNtQueryVirtualMemory = (TNtQueryVirtualMemory)GetPr0cAddr3ss(GetModu1eH4ndle(skCrypt(L"ntdll.dll")), skCrypt("NtQueryVirtualMemory"));

NTSTATUS status;

PBYTE pMem = nullptr;

DWORD dwMemSize = 0;

do

{

dwMemSize += 0x1000;

pMem = (PBYTE)_malloca(dwMemSize);

if (!pMem)

return false;

memset(pMem, 0, dwMemSize);

status = pfnNtQueryVirtualMemory(GetCurrentProcess(), NULL, MemoryWorkingSetList, pMem, dwMemSize, NULL);

} while (status == STATUS_INFO_LENGTH_MISMATCH);

PMEMORY_WORKING_SET_LIST pWorkingSet = (PMEMORY_WORKING_SET_LIST)pMem;

for (ULONG i = 0; i < pWorkingSet->NumberOfPages; i++)

{

DWORD dwAddr = pWorkingSet->WorkingSetList[i].VirtualPage << 0x0C;

DWORD dwEIP = 0;

__asm

{

push eax

call $ + 5

pop eax

mov dwEIP, eax

pop eax

}

if (dwAddr == (dwEIP & 0xFFFFF000))

return (pWorkingSet->WorkingSetList[i].Shared == 0) || (pWorkingSet->WorkingSetList[i].ShareCount == 0);

}

#endif // _WIN64

return false;

}

#pragma endregion

#pragma region Code Checksum Test

#ifndef _WIN64

static __declspec(naked) int code_checksum_test()

}

size_t calculate_function_size(PVOID pFunc)

}

unsigned bit_reverse(unsigned x)

}

unsigned int crc32(unsigned char *message, int size)

}

PVOID mem_code_checksum_func_addr;

size_t mem_code_checksum_func_size;

UINT32 mem_code_checksum_checksum;

void mem_code_checksum_init()

}

bool mem_code_checksum_check()

{

return crc32((PBYTE)mem_code_checksum_func_addr, mem_code_checksum_func_size) != mem_code_checksum_checksum;

}

#else

bool mem_code_checksum_check()

{

return false;

}

#endif

#pragma endregion

#pragma region Page Guard Violation

bool check_memory_pageguard()

}

#pragma endregion